On Fri, Oct 31, 2025 at 2:43 PM Tony Guadagno <[email protected]> wrote:
> Nick, hi, I now have my install in production and things are going pretty > well. No real user issues, but looking at the logs, I am seeing these. I > don’t think they are resulting in a user issue but I was wondering; should > I just ignore these? > > > > 17:19:28.432 [http-nio-8080-exec-6] INFO o.a.g.event.EventLoggingListener > - User "lnbadmin" (authenticated by "mysql") successfully authenticated > from 10.0.253.84 > > Exception in thread "Thread-64" java.lang.IllegalStateException: Message > will not be sent because the WebSocket session has been closed > > at > org.apache.tomcat.websocket.WsRemoteEndpointImplBase.writeMessagePart(WsRemoteEndpointImplBase.java:454) > > at > org.apache.tomcat.websocket.WsRemoteEndpointImplBase.sendMessageBlockInternal(WsRemoteEndpointImplBase.java:312) > > at > org.apache.tomcat.websocket.WsRemoteEndpointImplBase.sendMessageBlock(WsRemoteEndpointImplBase.java:265) > > at > org.apache.tomcat.websocket.WsRemoteEndpointImplBase.sendMessageBlock(WsRemoteEndpointImplBase.java:249) > > at > org.apache.tomcat.websocket.WsRemoteEndpointImplBase.sendString(WsRemoteEndpointImplBase.java:191) > > at > org.apache.tomcat.websocket.WsRemoteEndpointBasic.sendText(WsRemoteEndpointBasic.java:36) > > at > org.apache.guacamole.websocket.GuacamoleWebSocketTunnelEndpoint.sendInstruction(GuacamoleWebSocketTunnelEndpoint.java:152) > > at > org.apache.guacamole.websocket.GuacamoleWebSocketTunnelEndpoint.access$200(GuacamoleWebSocketTunnelEndpoint.java:53) > > at > org.apache.guacamole.websocket.GuacamoleWebSocketTunnelEndpoint$2.run(GuacamoleWebSocketTunnelEndpoint.java:253) > > 17:26:29.668 [http-nio-8080-exec-4] INFO > o.a.g.tunnel.TunnelRequestService - User "dayers" disconnected from > connection "3". Duration: 1609310 milliseconds > > 17:26:35.470 [http-nio-8080-exec-9] INFO > o.a.g.tunnel.TunnelRequestService - User "dayers" connected to connection > "3". > > Exception in thread "Thread-65" java.lang.IllegalStateException: Message > will not be sent because the WebSocket session has been closed > > at > org.apache.tomcat.websocket.WsRemoteEndpointImplBase.writeMessagePart(WsRemoteEndpointImplBase.java:454) > > at > org.apache.tomcat.websocket.WsRemoteEndpointImplBase.sendMessageBlockInternal(WsRemoteEndpointImplBase.java:312) > > at > org.apache.tomcat.websocket.WsRemoteEndpointImplBase.sendMessageBlock(WsRemoteEndpointImplBase.java:265) > > at > org.apache.tomcat.websocket.WsRemoteEndpointImplBase.sendMessageBlock(WsRemoteEndpointImplBase.java:249) > > at > org.apache.tomcat.websocket.WsRemoteEndpointImplBase.sendString(WsRemoteEndpointImplBase.java:191) > > at > org.apache.tomcat.websocket.WsRemoteEndpointBasic.sendText(WsRemoteEndpointBasic.java:36) > > at > org.apache.guacamole.websocket.GuacamoleWebSocketTunnelEndpoint.sendInstruction(GuacamoleWebSocketTunnelEndpoint.java:152) > > at > org.apache.guacamole.websocket.GuacamoleWebSocketTunnelEndpoint.access$200(GuacamoleWebSocketTunnelEndpoint.java:53) > > at > org.apache.guacamole.websocket.GuacamoleWebSocketTunnelEndpoint$2.run(GuacamoleWebSocketTunnelEndpoint.java:253) > > > These likely indicate that something is abnormally shutting down a connection. There are a couple of more common culprits for this: * The user(s) may just be closing their browser without disconnecting or logging off the session, which could generate these sorts of messages. If users are not complaining about being disconnected, this is the more likely scenario. * Some application firewalls (aka Layer 7 firewalls, Deep Packet Inspection, etc.) can interfere with connections. We've had reports of this in the past with firewalls that look for and terminate long-running HTTP(S)/WS(S) sessions, and Guacamole tunnels certainly fall into that category. If you start hearing complaints from users of their connections mysteriously dropping, but they're able to reconnect immediately and carry on, this may be the likely situation. Based on the log message above, I wonder if the second one is happening - it's hard to correlate those log messages exactly, but the fact that the user got dropped and immediately (6 seconds) reconnected, seems to indicate that it was an abnormal termination of the connection/tunnel. -Nick >
